diff --git a/external/source/shellcode/windows/x64/src/block/block_api.asm b/external/source/shellcode/windows/x64/src/block/block_api.asm index 9c40672ad2..fd9464a8a7 100644 --- a/external/source/shellcode/windows/x64/src/block/block_api.asm +++ b/external/source/shellcode/windows/x64/src/block/block_api.asm @@ -30,7 +30,7 @@ api_call: mov rdx, [rdx+0x20] ; Get the first module from the InMemoryOrder module list next_mod: ; mov rsi, [rdx+0x50] ; Get pointer to modules name (unicode string) - movzx rcx, word [rdx+0x4a] ; Set rcx to the length we want to check + movzx rcx, word [rdx+0x48] ; Set rcx to the length we want to check mov r9d, 0 ; Set r9 to the IV of the hashed module name loop_modname: ; xor rax, rax ; Clear rax diff --git a/external/source/shellcode/windows/x86/src/block/block_api.asm b/external/source/shellcode/windows/x86/src/block/block_api.asm index bedc7eee58..86d18e861c 100644 --- a/external/source/shellcode/windows/x86/src/block/block_api.asm +++ b/external/source/shellcode/windows/x86/src/block/block_api.asm @@ -23,7 +23,7 @@ api_call: mov edx, [edx+0x14] ; Get the first module from the InMemoryOrder module list next_mod: ; mov esi, [edx+0x28] ; Get pointer to modules name (unicode string) - movzx ecx, word [edx+0x26] ; Set ECX to the length we want to check + movzx ecx, word [edx+0x24] ; Set ECX to the length we want to check mov edi, 0 ; Set EDI to the IV of the hashed module name loop_modname: ; xor eax, eax ; Clear EAX diff --git a/external/source/shellcode/windows/x86/src/hash.py b/external/source/shellcode/windows/x86/src/hash.py index 2de9181f31..ab149ffc54 100755 --- a/external/source/shellcode/windows/x86/src/hash.py +++ b/external/source/shellcode/windows/x86/src/hash.py @@ -76,10 +76,11 @@ def unicode(string, uppercase=True): def hash(module, function, bits=13, print_hash=True): module_hash = 0 function_hash = 0 - for c in unicode(module + '\x00'): + for c in unicode(module): module_hash = ror(module_hash, bits) module_hash += ord(c) - for c in str(function + b'\x00'): + function_hash = module_hash + for c in str(function + '\x00'): function_hash = ror(function_hash, bits) function_hash += ord(c) h = module_hash + function_hash & 0xFFFFFFFF